October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,564
Critical
3,105
High
6,979
Medium
6,759
Low
599
Severity not reported
4,122
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (721), google (410), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113690 Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113691 Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT S... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113692 Path traversal in the SmartIT file-management feature of BMC IT Service Manageme... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113693 Exposure of sensitive information in the SmartIT system-account settings of BMC... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113694 Improper authorization in the SmartIT user attachment feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113695 Reflected cross-site scripting in the SmartIT inline-image attachment feature of... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113696 Improper authorization in the SmartIT change approval feature of BMC IT Service... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113697 Reflected cross-site scripting in the agent query feature of BMC Helix Operation... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-16889 In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /a... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66088 In openEQUELLA before 2026.1, the system.execute() function available to the scr... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66089 In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit o... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66090 In openEQUELLA before 2026.1, the XML parser used for item metadata does not dis... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66091 In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint per... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-66092 In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendere... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114358 This
vulnerability exists in the Radius
Xenia M2M Platform due to insufficient v... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-105031 When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-105042 A message body that is deeply nested and decoded by pn_message_body() could over... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114230 When dispatching SASL frames to authenticate the peer, Proton will also dispatch... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115942 A misconfigured wildcard TLS certificate causes a stack read overflow. |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-67414 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-54668 Kitodo.Production is a workflow management tool for mass digitization and is par... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-117611 Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115885 The LangGraph CLI is the official command-line interface for LangGraph. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115892 Wasmtime is a runtime for WebAssembly. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-101897 Angular is a development platform for building mobile and desktop web applicatio... |
not reported | — | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-116134 HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbou... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116135 HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-T... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous mu... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116266 MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded mul... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116267 MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116268 MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via un... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116269 MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename w... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116270 MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116271 MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created outpu... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate bou... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116273 MIME::Parser versions before 5.521 for Perl set no limit on the number of messag... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116285 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic r... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in ch... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117500 HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backt... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.